Set up suspend-then-hibernate (16G swapfile, resume, polkit override)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

NEON-CUSTOMIZATIONS.md

@@ -131,6 +131,48 @@ Tested 2026-09-27. The firmware offers both `s2idle` (default) and `deep`
   That one comes from ACPI LPIT, which isn't wired up properly under
   coreboot here: it read 270µs for the same suspend.
 
+## Suspend-then-hibernate (set up 2026-09-28)
+
+A lid close suspends (`s2idle`, instant). If the machine is still asleep
+after **3 hours**, systemd wakes it (RTC), writes a hibernation image to
+disk and powers off. This protects against a dead battery without
+writing a multi-GB image on every lid close, which is why this was
+chosen over hybrid sleep. It doesn't need S3.
+
+Pieces:
+- **16GB `/swapfile`**, used for the hibernation image (sized to RAM for
+  the worst case; a typical image is ~4GB).
+  fstab `/swapfile none swap sw,pri=10 0 0`: priority 10 < zram's 100,
+  so normal swapping still goes to zram. Backup of the old fstab:
+  `/etc/fstab.bak-2026-09-28`.
+- **Resume location**: `resume=UUID=3af45daa-b8c2-4053-9574-a958e0c3ea68
+  resume_offset=17674240` in `GRUB_CMDLINE_LINUX_DEFAULT` (backup
+  `/etc/default/grub.bak-2026-09-28`) and in
+  `/etc/initramfs-tools/conf.d/resume`, then `update-initramfs -u -k all`
+  + `update-grub`. **If `/swapfile` is ever recreated, its offset
+  changes.** Get the new one with
+  `sudo filefrag -v /swapfile | awk '$1=="0:"{print $4}'` (strip the
+  trailing `..`), then update both places and rerun both commands.
+- **`/etc/systemd/sleep.conf.d/50-suspend-then-hibernate.conf`**:
+  `HibernateDelaySec=3h`.
+- **`/etc/polkit-1/rules.d/10-enable-hibernate.rules`**: Ubuntu's
+  `/usr/share/polkit-1/rules.d/com.ubuntu.desktop.rules` returns `NO` for
+  all `login1`/`upower` hibernate actions, so logind reported
+  `CanHibernate`/`CanSuspendThenHibernate` = `no` even though its sleep
+  checks passed (seen with
+  `systemctl service-log-level systemd-logind debug`). This rule sorts
+  earlier and returns `YES` for local, active users.
+- **Plasma**: PowerDevil owns the lid, so each Power Management profile's
+  sleep mode must be set to "Standby, then hibernate" in System Settings.
+
+Tested 2026-09-28 with `systemctl hibernate`: a 3.8GB image, powered off,
+and the session resumed intact (uptime carried over, root `rw`). Right
+after resume, one readahead READ failed on `sda` ("device offline or
+changed") while the microSD reader was being reset. That's harmless:
+readahead failures are dropped, and ext4 logged no errors and stayed
+`clean`. It's the same reader re-attach that breaks S3, but a hibernate
+resume is a cold boot and the reader was back in time.
+
 ## Networking
 
 - **Realtek USB Ethernet (`enx00e04c68003e`, r8152-family 2.5G